How to Analyze a Suspicious URL

Analyzing a URL means breaking it down and testing each signal instead of trusting how it looks. A link can read like paypal.com at a glance and still belong to an attacker. The good news: you can analyze a suspicious URL — read its structure, find the real owner, and test its reputation — without ever visiting the page. This guide walks through the anatomy of a URL and a repeatable process for inspecting any link.

Anatomy of a URL: how to read it

Almost every URL trick works by getting you to read the wrong part of the link. Before you can analyze a suspicious URL, you need to know which piece actually identifies its owner. A link breaks into five parts:

• Scheme — https:// or http://. HTTPS only means the connection is encrypted; it says nothing about who is on the other end. Attackers use HTTPS too.
• Subdomain — anything before the registrable domain, like login. or secure.. The owner can put any text here, including a trusted brand name.
• Registrable domain — the real owner of the link: the label immediately before the first single slash, together with its TLD (for example example.com). This is the piece that matters most.
• Path — everything after the domain, like /login or /verify/account. The path is fully controlled by the site owner and can say anything.
• Query — the part after ?, like ?id=123&ref=email. Useful context, but also fully attacker-controlled.

The single most important rule: read the hostname from right to left and stop at the first single slash. The registrable domain is the label just before that slash. Compare these three links:

• https://paypal.com/login — registrable domain is paypal.com. Real PayPal.
• https://paypal.login.attacker.top/verify — registrable domain is attacker.top. The paypal.login part is just a subdomain the attacker owns; this is not PayPal.
• https://login-paypal.com — registrable domain is login-paypal.com, a look-alike domain someone registered to impersonate the brand. Again, not PayPal.

Same brand name, three completely different owners. Once you can spot the registrable domain, most phishing links give themselves away.

How to analyze a suspicious URL step by step

Here is a repeatable process you can run on any link you don’t trust:

1. Don’t click. Copy the full link instead — right-click and choose “Copy link address”, or long-press on mobile. Everything else you can do without loading the page.
2. Expand any shortener and follow the redirect chain. A bit.ly or t.co link hides its real target, so expand it with the short URL expander and trace every hop with the redirect checker. The final destination is what you actually need to analyze.
3. Identify the true registrable domain. Apply the right-to-left rule to the final URL and ignore any brand name that appears in a subdomain or path.
4. Check domain age & reputation, and the hosting IP. Brand-new domains and bad hosts are strong signals. Run the domain through the domain reputation check and look up the server with the IP reputation check.
5. Check for look-alike and homoglyph tricks. Characters like paypa1.com (digit one for the letter L) or Cyrillic look-alikes are built to fool the eye. The typosquatting detector compares the domain against known brands.
6. Run it through an automated analyzer. Finally, paste the link into the URL analyzer to test it against Google Safe Browsing, PhishTank, and threat-intelligence feeds in one pass — and to catch anything your manual read missed.

Steps 1–5 are the manual read; step 6 is the automated confirmation. Doing both is how you analyze a URL with confidence instead of guessing.

Signals a URL analyzer checks automatically

Running every check above by hand is thorough but slow. A URL analyzer performs the same inspection in seconds and evaluates signals you can’t see from the link text alone:

• Reputation feeds — Google Safe Browsing, PhishTank, and 17+ threat-intelligence lists of known-malicious domains.
• Domain age — freshly registered domains are disproportionately used for phishing and malware.
• SSL certificate — whether the certificate is valid, and what name it was actually issued to.
• Redirects — the full chain from a shortener or cloak to the real landing page.
• Page content & credential forms — login boxes, password fields, and brand impersonation on the destination page.
• TLD risk — abuse-prone endings like .top, .xyz, or .zip that scams cluster on.

For a deeper look at who owns a domain, when it was registered, and how it is hosted, the domain intelligence tool adds registrar, DNS, and hosting context on top of the verdict.

Test a URL safely (without visiting it)

The whole point of analyzing a link this way is that you never have to open it. A scanner fetches and evaluates the page on your behalf, in its own environment, so the destination loads in the analyzer — not in your browser. That means you can test a suspicious URL, read its content and redirects, and get a verdict without ever exposing your device to a drive-by download or a credential-harvesting form.

Frequently asked questions